John the Ripper (aka. JtR aka. john) is a well-known penetration testing tool used for cracking passwords through various attacks including brute-force and dictionary.
Cracking modes
Single crack mode
Single crack mode is a rule-based cracking technique that is most useful when targeting Linux credentials.
It generates password candidates based on the victim's username, home directory name, and GECOS values (full name, room number, phone number, etc.).
$ john --single passwd
Wordlist mode
Wordlist mode is used to crack passwords with a dictionary attack, meaning it attempts all passwords in a supplied wordlist against the password hash.
$ john --wordlist=<wordlist_file> <hash_file>
Incremental mode
Incremental mode is a powerful, brute-force-style password cracking mode that generates candidate passwords based on a statistical model (Markov chains).
$ john --incremental <hash_file>
By default, JtR uses predefined incremental modes specified in its configuration file (john.conf), which define character sets and password lengths.
$ grep '# Incremental modes' -A 100 /etc/john/john.conf
Automatic Cracking mode
$ john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Identifying hash formats
https://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats
https://github.com/psypanda/hashID
https://hashes.com/en/tools/hash_identifier
$ hashid -j 193069ceb0461e1d40d216e32c79c704
The --format argument can be supplied to instruct JtR which format target hashes have.
Format-specific Cracking
format: md5,sha1,sha512,NTLM hashleri belirtmek için kullanılır.
$ john --format=[format] --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
$ john --list=formats
MD5 yada SHA256 için
$ john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt filehash.txt
$ john --format=raw-256 --wordlist=/usr/share/wordlists/rockyou.txt filehash.txt
| Hash format | Example command | Description |
| afs | john --format=afs [...] <hash_file> | AFS (Andrew File System) password hashes |
| bfegg | john --format=bfegg [...] <hash_file> | bfegg hashes used in Eggdrop IRC bots |
| bf | john --format=bf [...] <hash_file> | Blowfish-based crypt(3) hashes |
Cracking files
It is also possible to crack password-protected or encrypted files with JtR. Multiple "2john" tools come with JtR that can be used to process files and produce hashes compatible with JtR.
<tool> <file_to_crack> > file.hash
| Tool | Description |
| pdf2john | Converts PDF documents for John |
| ssh2john | Converts SSH private keys for John |
| mscash2john | Converts MS Cash hashes for John |
| keychain2john | Converts OS X keychain files for John |
| rar2john | Converts RAR archives for John |
| pfx2john | Converts PKCS#12 files for John |
| truecrypt_volume2john | Converts TrueCrypt volumes for John |
| keepass2john | Converts KeePass databases for John |
| vncpcap2john | Converts VNC PCAP files for John |
| putty2john | Converts PuTTY private keys for John |
| zip2john | Converts ZIP archives for John |
| hccap2john | Converts WPA/WPA2 handshake captures for John |
| office2john | Converts MS Office documents for John |
| wpa2john | Converts WPA/WPA2 handshakes for John |
| ...SNIP... | ...SNIP... |
$ locate *2john*
Cracking /etc/shadow Hashes
$ unshadow /etc/passwd /etc/shadow > unshadow.txt
$ john --format=crypt --wordlist=/usr/share/wordlists/rockyou.txt unshadow.txt
Cracking SSH Key Passwords
id_rsa kırmamız gerek, zaten username biliniyorsa bu dosyayı kullanarak ssh bağlantısı ; chmod 600 id_rsa verilerek bağlanılabilir.
$ ssh -i id_rsa username@host
$ ssh2john id_rsa > idbul.txt
$ john --wordlist=/usr/share/wordlists/rockyou.txt idbul.txt
Cracking Password Protected RAR Archives
$ rar2john secure.rar > unsecure.txt
$ john --wordlist=/usr/share/wordlists/rockyou.txt unsecure.txt
Cracking Password Protected Zip Files
$ zip2john secure.zip > unsecure.txt
$ john --wordlist=/usr/share/wordlists/rockyou.txt unsecure.txt